CVE-2011-4899High· 7.5▾ MidnightPoC availablewp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbh…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 1.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
9.0%
Exploit-DB (last check)
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
wordpress <= 3.3.1wordpress = 0.7wordpress = 0.71wordpress = 0.72wordpress = 0.711wordpress = 1.0wordpress = 1.0.1wordpress = 1.0.2wordpress = 1.2wordpress = 1.2.1wordpress = 1.2.2wordpress = 1.5wordpress = 1.5.1wordpress = 1.5.1.2wordpress = 1.5.1.3wordpress = 1.5.2wordpress = 2.0wordpress = 2.0.1wordpress = 2.0.2wordpress = 2.0.3wordpress = 2.0.4wordpress = 2.0.5wordpress = 2.0.6wordpress = 2.0.7wordpress = 2.0.8wordpress = 2.0.9wordpress = 2.0.10wordpress = 2.0.11wordpress = 2.1wordpress = 2.1.1wordpress = 2.1.2wordpress = 2.1.3wordpress = 2.2wordpress = 2.2.1wordpress = 2.2.2wordpress = 2.2.3wordpress = 2.3wordpress = 2.3.1wordpress = 2.3.2wordpress = 2.3.3wordpress = 2.5wordpress = 2.5.1wordpress = 2.6wordpress = 2.6.1wordpress = 2.6.2wordpress = 2.6.3wordpress = 2.6.5wordpress = 2.7wordpress = 2.7.1wordpress = 2.8wordpress = 2.8.1wordpress = 2.8.2wordpress = 2.8.3wordpress = 2.8.4wordpress = 2.8.5wordpress = 2.8.6wordpress = 2.9wordpress = 2.9.1wordpress = 2.9.2wordpress = 3.0wordpress = 3.0.1wordpress = 3.0.2wordpress = 3.0.3wordpress = 3.0.4wordpress = 3.0.5wordpress = 3.0.6wordpress = 3.1wordpress = 3.1.1wordpress = 3.1.2wordpress = 3.1.3wordpress = 3.1.4wordpress = 3.2.1wordpress = 3.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119977High· 8.1WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
CVE-2026-87902High· 8.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories
CVE-2026-93485High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
CVE-2026-63030Critical· 9.8WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL In…
CVE-2026-60137Medium· 5.9WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVE-2026-114570Medium· 4.9WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit